删除 Opera Mini 浏览器代码中的自动完成功能
我们公司有一个基于移动网络的应用程序。由于应用程序的性质，我们不希望用户手机上的浏览器提示用户将密码保存在表单上，即自动完成功能。
我们通过将自动完成标签设置为“关闭”，成功地为 IE 和 Firefox 做到了这一点，但这似乎不适用于 Opera mini（我猜一般是 Opera）。我知道用户可以在其设置中将其设置为关闭，但出于安全原因，我们宁愿将其禁用？
有没有通过代码解决这个问题的方法？该应用程序是使用基于 Jboss/Apache 架构的 faces 组件的 Java 应用程序。
We have a mobile web based app at my company. Due to the nature of the application we do not want the browser on the users phone to prompt the user to save the passwords on the form a.k.a the autocomplete feature.
We managed to do that for IE and Firefox by setting the autocomplete tag to "off" but that doesnt seem to work for Opera mini (and i am guessing opera in general). I know user's can set it to off in their settings but for security reason we rather have it disabled?
Is there a workaround for this through code? the app is Java app using faces components based on an Jboss/Apache architecture.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
一般来说，Opera 允许用户配置是否应该遵守 autocomplete=off。原则上，用户应该能够配置密码存储功能，并且网站不应该能够随意影响配置。
然而，我当然可以看到，对于特定场景，例如“通过短信向 Opera 记住常规密码的设备发送一次性密码”，这很糟糕。如果您存储了高价值网站的密码+使用短信一次性密码作为“带外”身份验证，那么丢失手机将成为主要风险。这个问题的根源在于短信构成“三因素”身份验证的假设 - 如果存储的登录信息和短信位于同一设备上，则它不再是“三因素”。
试图让用户留在其中是很棘手的控制权，同时在确实是个好主意时屈服于网站。可悲的是，我认为这是目前尚未解决的问题。
如果您有一个禁用密码存储的良好用例并且正在处理一个重要站点，也许可以说服 Opera Mini 服务器管理员在特定站点上禁用密码管理器？我不知道，但如果你将其作为错误报告给 Opera，至少会给内部讨论带来更多动力。请随时与我联系并参考错误报告，因为我可以密切关注它;-)
In general, Opera lets the user configure whether it should respect autocomplete=off. On principle, users should be able to configure the password storage feature, and web sites should not be able to affect the configuration at a whim.
However, I can certainly see that for specific scenarios, like "send one-time passwords by SMS to the device Opera remembered the regular password on", this sucks. If you have stored password for a high-value site + use SMS one-time passwords as an "out of band" authentication, a lost phone becomes a major risk. The root of this problem is the assumption that an SMS constitutes "three-factor" authentication - if the stored login and the SMS is on the same device it's no longer "three-factor"..
It is tricky to try to leave users in control, while yielding to the web site when it's a really good idea to do so. Sadly, I think this is an unsolved question for now.
If you have a good use case for disabling password storage and are working on an important site, perhaps Opera Mini server admins could be persuaded to disable password manager on a site-specific basis? I don't know, but if you report it as a bug to Opera it would at least give the internal discussions some more momentum. Feel free to contact me with a reference to the bug report because I'm in a position where I could keep an eye on it ;-)